Skip to content

ecs: add args_count field - #64

Open
Vladimir-A wants to merge 505 commits into
sysflow-telemetry:masterfrom
Vladimir-A:patch-1
Open

ecs: add args_count field#64
Vladimir-A wants to merge 505 commits into
sysflow-telemetry:masterfrom
Vladimir-A:patch-1

Conversation

@Vladimir-A

@Vladimir-AVladimir-A commented May 18, 2024

Copy link
Copy Markdown

Added implementation of the args_count field for process and pprocess.
ecs_mapping

araujofand others added 30 commits January 20, 2022 16:30
@araujof
fix(core): fix linting issues; refactor thread pool and fix start/sto…
b6783b3
…p lifecycle when used with policy monitor; refactor policy monitor and simplified usage in policy engine
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(core): fix interpreter unit tests where argument was missing to i…
2987586
…nterpreter constructor
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
update(docs/core): update key word of action direcory; updated docs w…
8f8eb03
…ith monitor parameters
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
update(core): Merge pull requestsysflow-telemetry#39from san-zrl/v_…
5300e52
…0_4_0
This PR fixes the mode ambiguity in the policy engine and adds pluggable action handling to the processor.
@araujof
build(scripts): added Cpack scripts for packagin the processor in DEB…
653c351
…, RPM, and TZ.
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
refact(scripts): cleaned up commented lines from cpack script
aa19088
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): added license and readme files to binary packages
5bc1058
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): update make package rule to export sysflow version fr…
3dfd3fd
…om manifest
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(config): added missing mode attribute to example pipeline configs
9d2328a
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): added systemd service definition and sysflow launcher…
7430ad5
… to packaged distributions
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): updated systemd service definition
f8ae96b
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): updated systemd service dafaults
c825ad3
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(core): fix error message linting issue
44bf117
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(ci): setting golangci-lint to v1.42.1 (latest release breaks th…
35f93fb
…e linter step)
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(merge): Merge branch 'dev' of github.com:sysflow-telemetry/sf-p…
ed8706f
…rocessor into dev
@araujof
fix(scripts): fix installation paths using rpm
147cec4
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(mods): updated sysflow apis to ab7fe1f
a0fcb58
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(merge): merged dev into feature branch
be7b5ae
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(merge): merge feature branches
22dd41d
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(ci): removed codeql workflow
2fa870f
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(driver): create base socket dir if non existent
bc8217b
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(merge): fix merge conflict
de8240b
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): updated systemd service definition to use environment…
e34ce17
… variable for domain socket path
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(build): removes system docker gid from docker build (portability)
7f6c032
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): changed packaging to obtain binary from docker image
03a9d13
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(scripts): fix environment variable in systemd service exec command
453bcd1
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(docker): bump go version to go1.17.6
7517f15
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
update(ci): added release job
15e65a5
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(changelog): updated to use reference links
057fa9b
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(changelog): updated CHANGELOG in preparation for 0.4.0
595ac4f
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
araujofand others added 23 commits September 5, 2023 20:34
@araujof
Merge pull requestsysflow-telemetry#49from sysflow-telemetry/go1.19…
3d54fd4
…-sigma
Go1.19 sigma
@araujof
chore(ci): removed deprecated set-output commands
4b5b7b8
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(ci): update deprecated actions
4d2b925
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(manifest): bumped UBI to 8.8-1032.1692772289
2d51a16
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): fix plugin builder tags
416acd3
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): fix plugin builder action
849b115
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): fix regression error in CI
d329715
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
Merge pull requestsysflow-telemetry#54from sysflow-telemetry/dev
11f8140
Dev
@araujof
chore(apis): update sf-apis to track 0.6.0-rc1
8648053
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(docker): bump to ubi9
c0017d0
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(readme,changelog): preparation for 0.6.0-rc1
9f18a66
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(docker): bump runtime stage to ubi9
ce8f0d5
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(merge): rebase dev
b26dcd0
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@dependabot@araujof
chore(deps): bump gopkg.in/yaml.v3 in /plugins/handlers/printer (sysf…
847f4d8
…low-telemetry#55)
Bumps gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.0.
---
updated-dependencies:
- dependency-name: gopkg.in/yaml.v3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot@araujof
chore(deps): bump golang.org/x/net in /core (sysflow-telemetry#56)
bd9b269
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20220114011407-0dd24b26b47d to 0.7.0.
- [Commits](https://github.com/golang/net/commits/v0.7.0)
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@araujof
chore(readme): update security patches
3366ff2
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): fix build of release assets
480d92f
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(manifest): bump ubi to 9.3-1361.1699548029
564d3f0
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@msardara
fix(core): fix double call to StartWorkers() function when policy are…
bd025c6
… reloaded (sysflow-telemetry#59)
Signed-off-by: Mauro Sardara <msardara@cisco.com>
@araujof
chore(manifest): updated manifest for 0.6.1
c6dc08b
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat: bump to UBI 9.3-1610
51f38d5
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore: updated manifest
856e158
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@Vladimir-A
ecs: add args_count field
da09f0c
Signed-off-by: Anikeev Vladimir <anikivladimir5@gmail.com>
@Vladimir-A

Vladimir-A commented Jul 4, 2024

Copy link
Copy Markdown
Author

@araujof, is there a chance that this request will be merged?

@araujof

araujof commented Jul 12, 2024

Copy link
Copy Markdown
Member

Hi @Vladimir-A -- sorry for my delayed response. I was on leave and just catching up on things.

I will review the PR. Thanks for your contribution!

@araujofaraujof added the enhancement New feature or request label Jul 12, 2024
@araujof
araujof self-requested a review July 12, 2024 14:42
araujof
araujof reviewed Jul 12, 2024
View reviewed changes

@araujofaraujof left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest you refactor the code to use the shlex package to split the command options into tokens that can then be used to count the command line arguments. Once the initial split is done, we can use some simple heuristics to parse the slice into groups of keyword and positional arguments, and then get a final count on those groups. We should create a helper function for this.

@terylpt any additional thoughts?

Comment threadcore/exporter/encoders/ecs.go
exe := flatrecord.Mapper.MapStr(flatrecord.SF_PROC_EXE)(rec)
args_count := 0
if flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec) != "" {
args_count = len(strings.Split(flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec), " "))

@araujofaraujofJul 12, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This simple splitting strategy may lead to false positives. A more accurate counter should consider quotes, positional and keyword arguments. My suggestion is to use shlex: https://pkg.go.dev/github.com/google/shlex

A perfect solution might not be simple, but we can probably use shlex to handle most cases.

Comment threadcore/exporter/encoders/ecs.go
pexe := flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_EXE)(rec)
pargs_count := 0
if flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec) != "" {
pargs_count = len(strings.Split(flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec), " "))

@araujofaraujofJul 12, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same comment applies here. We need a better strategy to parse/split the command options string.

@araujof

araujof commented Dec 18, 2024

Copy link
Copy Markdown
Member

@Vladimir-A do you still plan to work on this PR? Otherwise, I might close it for now. Please let me know.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@araujofaraujofaraujof left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

enhancementNew feature or request

Projects

0.7.0
Status: No status

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@Vladimir-A@araujof@terylt@san-zrl@VishwasSomasekhariah@ysaquib@msardara